> ## Documentation Index
> Fetch the complete documentation index at: https://docs.instantcompliance.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> How fast you can call the API, and what to do when you hit the ceiling.

Each API key is independently rate-limited.

## Limits

| Window | Default                          |
| ------ | -------------------------------- |
| Burst  | **60 requests per minute**       |
| Daily  | **10,000 requests per 24 hours** |

These limits apply per **API key**, not per organisation — so a key
issued to Zapier and a key issued to your internal cron each get their
own budget.

## When you hit the limit

You receive **429 rate\_limited** with a `Retry-After` header:

```http theme={null}
HTTP/1.1 429 Too Many Requests
Retry-After: 12
Content-Type: application/json

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded. Slow down and retry shortly.",
    "details": { "limit": 60, "window_seconds": 60 }
  }
}
```

## Honouring `Retry-After`

Wait at least `Retry-After` seconds before retrying. A simple backoff
loop:

```javascript theme={null}
async function withRateLimit(fn) {
  for (let attempt = 0; attempt < 5; attempt++) {
    const res = await fn();
    if (res.status !== 429) return res;
    const wait = Number(res.headers.get('Retry-After') ?? 5);
    await new Promise((r) => setTimeout(r, wait * 1000));
  }
  throw new Error('Rate limited repeatedly');
}
```

## Need higher limits?

Most integrations sit far below the default. If you have a legitimate
need for a higher ceiling — bulk migrations, high-volume nightly sync
— contact [support@instantcompliance.ai](mailto:support@instantcompliance.ai)
with a description of the workload.

## Best practices

* **Batch via cursor pagination** instead of N parallel calls.
* **Use `updated_since`** so polling pulls only changed records.
* **Spread cron jobs.** Pick a random minute offset so all customers
  don't poll on the same `:00`.
* **Cache reads** in your own CRM. Hit our API for refreshes, not for
  every page load.